CVE-2026-115503 Ghidra before 12.2 Denial of Service via Compressed Extension Archive

What is CVE-2026-115503?

CVE-2026-115503 is a medium-severity vulnerability in NationalSecurityAgency ghidra, published on 22 Oct 2026.

Official description

Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.

Weakness: CWE-409

Which versions are affected by CVE-2026-115503?

It affects 1 product.

Products include Nsa Ghidra.

How do I fix CVE-2026-115503?

No fix has been published for CVE-2026-115503 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-115503 being exploited?

There is no known exploitation of CVE-2026-115503 in the wild and no public exploit code.

Other vulnerabilities in NationalSecurityAgency ghidra

• CVE-2023-22671 Command injection in n/a Critical 9.8
• CVE-2019-16941 XML external entity in n/a Critical 9.8
• CVE-2019-13625 XML external entity in n/a Critical 9.1
• CVE-2026-4946 NSA Ghidra Auto-Analysis Annotation Command Execution High 8.8
• CVE-2026-49498 Ghidra 11.0 < 12.1 - SQL Injection in PostgreSQL Password Change via Unescaped Username High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-gmcq-gg82-5fvc, GHSA-mcjr-7qqr-m3w8.